denozord/strongswan-ext
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,843 Commits 3 Branches 0 Tags
a3232fa802b08447d3fb9534da5342992eee5337
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner a3232fa802 pki: Load dnskey plugin to encode public keys in RFC 3110 format 2013-09-13 15:23:48 +02:00
Tobias Brunner d6c43847be Merge branch 'man-pki' 
This adds man pages for all pki sub-commands and promotes pki to a
regular program installed in $prefix/bin.

The usage output of several commands was fixed too.
 2013-09-13 15:17:04 +02:00
Tobias Brunner ed56c86ec1 pki: Don't print an error if no arguments are given 2013-09-13 15:14:00 +02:00
Tobias Brunner 0dc8ba8779 pki: Install pki(1) as utility directly in $prefix/bin 
ipsec pki is maintained as alias.
 2013-09-13 15:07:36 +02:00
Tobias Brunner 1a8ffea315 pki: Add example commands to setup a simple CA 2013-09-13 15:07:36 +02:00
Tobias Brunner b068c4ec9d pki: Add pki --verify man page 2013-09-13 15:07:36 +02:00
Tobias Brunner 4adeaa5eb9 pki: Add pki --pub man page 2013-09-13 15:07:36 +02:00
Tobias Brunner a319eff80d pki: Add pki --print man page 2013-09-13 15:07:35 +02:00
Tobias Brunner e69fd30538 pki: Add pki --keyid man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 558771400e pki: Add pki --pkcs7 man page 2013-09-13 15:07:35 +02:00
Tobias Brunner bb8e2e1759 pki: Add pki --req man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 96aa5a1ddd pki: Add pki --signcrl man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 42e3a21e24 pki: Add pki --issue man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 3a643b8901 pki: Add pki --self man page 
Can be opened with "man pki --self".
 2013-09-13 15:07:35 +02:00
Tobias Brunner a612f6e338 pki: Add pki --gen man page 
Can be opened with "man pki --gen".
 2013-09-13 15:07:29 +02:00
Tobias Brunner 34cff9349b pki: Add ipsec-pki(8) man page 
Can be opened either with "man ipsec pki" or "man ipsec-pki".

Since man(1) only supports one level of subpages, the forthcoming man
pages for each command will have to be opened with "man pki --<command>".
 2013-09-13 14:32:51 +02:00
Tobias Brunner b07aee496a strongswan.conf: Use configured piddir for UNIX sockets 2013-09-13 14:32:51 +02:00
Tobias Brunner 8250fc10e8 Build generated man pages via configure script 2013-09-13 14:32:51 +02:00
Tobias Brunner f5dcb38ead resolve: Remove comment when using resolvconf(8) 
Since comments in resolv.conf are only valid at the beginning of a line
resolvconf(8) seems to have started treating any text after
'nameserver <ip>' as additional IP addresses for name servers.

Since it ignores comments, and we can easily remove the added servers
again, there is no point to add any.

Fixes #410.
 2013-09-13 14:13:21 +02:00
Tobias Brunner 11ac36b016 conftest: Don't load plugins incrementally 
This is not supported by the plugin loader, so we simply combine the
plugin lists and load them all at once.
 2013-09-13 11:44:04 +02:00
Tobias Brunner fafa768478 ikev1: Fix double free when searching for redundant CHILD_SAs 
Fixes #411.
 2013-09-13 10:14:45 +02:00
Tobias Brunner be8179abd2 Build all IMC/IMVs with -no-undefined 2013-09-12 01:44:50 +02:00
Tobias Brunner 7d87b24634 pt-tls-client: Report loaded plugins 2013-09-12 01:44:49 +02:00
Tobias Brunner 5d45bcfc5f pt-tls-client: Abort if no tnccs-manager is available 2013-09-12 01:44:49 +02:00
Tobias Brunner 9af44ef5d9 Build all shared libraries with -no-undefined and link them properly 
The flag is required to convince libtool on Cygwin to build DLLs. But on
Windows these shared libraries can not have undefined symbols, so we have to
link them explicitly to the libraries they reference.

For plugins this is currently not done, so only the monolithic build is
supported.  The plugin loader wouldn't be able to load DLLs anyway, as
it tries to load files that don't exist on Cygwin.
 2013-09-12 01:44:49 +02:00
Tobias Brunner 3cb4552da6 configure: libtls and libtnccs etc. all require libstrongswan 2013-09-12 01:44:49 +02:00
Tobias Brunner bf32cdfbf6 tun_device: Add warning if TUN devices are not supported by platform 2013-09-12 01:44:49 +02:00
Tobias Brunner 4eb6149ae8 sockets: Initialize the whole ancillary data buffer not only the actual struct 
This avoids uninitialized bytes that Valgrind seems to notice otherwise.

Fixes #395.
 2013-09-10 13:42:59 +02:00
Tobias Brunner 70aefb9430 Store object files in the same directory as the source files 
Future automake releases will apparently do that implicitly, but current
releases spit out nasty warning messages.
 2013-09-05 14:24:26 +02:00
Tobias Brunner a4b996c0bc libipsec: Properly initialize variables when creating AEAD wrapper 2013-09-04 16:18:29 +02:00
Tobias Brunner c742905f50 android: Fix compilation after PTS header files were moved 2013-09-04 16:18:29 +02:00
Tobias Brunner cd764f42b9 libpts: Android.mk updated 2013-09-04 16:18:29 +02:00
Tobias Brunner 0b47bb5377 pubkey_speed: Add missing plugins 
The pkcs1 plugin is required to test the gmp/gcrypt plugins. Likewise,
the pem plugin is required when testing the openssl plugin.

Fixes #401.
 2013-09-04 10:01:46 +02:00
Tobias Brunner f17322dccb pubkey_speed: sudo is not required 
Also, refer to pubkey_speed properly when not being called from the same
directory.
 2013-09-04 09:53:36 +02:00
Tobias Brunner f1d5d87619 pubkey_speed: Add header and fix usage 2013-09-04 09:53:36 +02:00
Tobias Brunner 5ee0747cfd autoconf: Split PACKAGE_VERSION in four parts 
The parts can be accessed with the variables:

	PACKAGE_VERSION_MAJOR
	PACKAGE_VERSION_MINOR
	PACKAGE_VERSION_BUILD
	PACKAGE_VERSION_REVIEW

The last part will be empty for regular releases.
 2013-09-02 11:30:24 +02:00
Tobias Brunner 10a69c32c2 conftest: Fix hook constructor resolution via dlsym() 
AM_CPPFLAGS only takes preprocessor flags like -I or -D, so it did not
forward -rdynamic to the linker (--export-dynamic), which meant that the
symbols defined in the executable itself were not resolvable via dlsym().

Fixes #394.
 2013-08-30 19:45:51 +02:00
Tobias Brunner 2a7a9471dd aes-test: Rename crypt() as it conflicts with a library function on Mac OS X 
unistd.h on Linux defines this only if _XOPEN_SOURCE is defined.
 2013-08-30 08:51:09 +02:00
Tobias Brunner 9455f8b386 aes-test: Support test vectors at the end of a file 2013-08-24 16:22:51 +02:00
Tobias Brunner 8972c72237 aes-test: Add script to test AES implementations according to AESAVS/GCMVS 2013-08-24 16:22:51 +02:00
Tobias Brunner f0c54e8c15 chunk: Print chunks without separator if + modifier is used 2013-08-24 16:22:51 +02:00
Tobias Brunner 32a145fdbd utils: Add case-insensitive version of strpfx() 2013-08-24 16:22:51 +02:00
Tobias Brunner d7ae0b254d kernel: Restore enumeration of all addresses when searching for address in TS 
Since f52cf07532 addresses on ignored, down or loopback interfaces were
not considered as valid addresses anymore when searching for an address
contained in the local traffic selector.  This meant that route
installation failed, for instance, if charon.install_virtual_ip_on was
set to 'lo', or, on gateways, if internal interfaces were ignored with
the charon.interfaces_* options.
 2013-08-21 17:01:03 +02:00
Tobias Brunner 85ca2f7441 conftest: Disable reset_seq hook on systems other than Linux 
Fixes #386.
 2013-08-21 11:27:28 +02:00
Tobias Brunner e001cc2b07 kernel-netlink: Fix calculation of ESN bitmap length 
While bmp_len stores the number of u_int32_t the allocated bitmap
actually consists of those integers.
 2013-08-21 08:28:12 +02:00
Tobias Brunner f853e7bcc0 ikev1: Fix calculation of the number of fragments 
The old code resulted in too few fragments in some cases.
 2013-08-15 15:15:34 +02:00
Tobias Brunner c81a6ff907 ikev1: When sending fragments, use ports to decide if a non-ESP marker is added 
This is same same logic used by sender and might apply in some cases (e.g.
when initiating to port 4500).
 2013-08-15 15:12:00 +02:00
Tobias Brunner e42ab08a73 ikev2: Fix segfault when reestablishing CHILD_SAs due to closeaction=restart|hold 
This regression was introduced with c949a4d5.
 2013-08-13 10:08:08 +02:00
Tobias Brunner 3f29ff82c3 libipsec: Don't limit traditional algorithms to AES and SHA1/2 
Closes #377.
 2013-08-12 12:21:57 +02:00
Tobias Brunner 11f468533f kernel-netlink,pfroute: Properly update address flag within ROAM_DELAY 
77d4a02 and 55da01f only updated the address flag when a job was created,
which obviously had the same limitation as the old code.

Fixes #374.
 2013-08-12 12:08:23 +02:00
Tobias Brunner 55da01f348 kernel-pfroute: Implement roam event handling like in the kernel-netlink plugin 
There was no proper locking and the issue regarding the address
flag also existed.
 2013-08-12 12:03:48 +02:00
Tobias Brunner 77d4a0281a kernel-netlink: Ensure address changes are not missed in roam events 
If multiple roam events are triggered within ROAM_DELAY, only one job is
created.  The old code set the address flag to the value of the last
triggering call.  So if a route change followed an address change within
ROAM_DELAY the address change was missed by the upper layers, e.g. causing
it not to update the list of addresses via MOBIKE.

The new code now keeps the state of the address flag until the job is
actually executed, which still has some issues.  For instance, if an
address disappears and reappears within ROAM_RELAY, the flag would not
have to be set to TRUE.  So address updates might occasionally get
triggered where none would actually be required.

Fixes #374.
 2013-08-12 12:02:55 +02:00
Tobias Brunner e99cfe5f20 strongswan.conf: Add note about reserved threads 2013-08-07 09:06:01 +02:00
Tobias Brunner 58e32e4871 tnc-pdp: Initialize struct msghdr properly when reading RADIUS messages 
Before this e.g. msg_controllen was not initialized properly which could
cause invalid reads.
 2013-07-31 22:16:58 +02:00
Tobias Brunner 3a938a6f85 NEWS: Add info about CVE-2013-5018 2013-07-31 22:16:58 +02:00
Tobias Brunner d12fc14616 whitelist: Fix compilation on FreeBSD 2013-07-31 22:16:58 +02:00
Tobias Brunner ed0efaef4c host: Properly initialize struct sockaddr_in[6] when parsing strings 
Otherwise struct members like sin6_flowinfo or sin6_scope_id might be
set to bogus values.
 2013-07-31 22:16:58 +02:00
Tobias Brunner b3393c88c1 asn1: Fix handling of invalid ASN.1 length in is_asn1() 
Fixes CVE-2013-5018.
 2013-07-31 22:16:58 +02:00
Tobias Brunner a566c5f837 receiver: Avoid cloning packet data when verifying COOKIE payloads 
Besides being more efficient this removes a memory leak that occurred
when a COOKIE payload was successfully verified.

Fixes #369.
 2013-07-29 22:04:24 +02:00
Tobias Brunner 1cf8022839 unity: Handle multi-valued UNITY_SPLIT_INCLUDE/UNITY_LOCAL_LAN attributes 
Cisco devices seem to add 6 bytes of padding between each address/mask
pair.

Fixes #366.
 2013-07-29 21:44:27 +02:00
Tobias Brunner 4dc8978000 ikev2: Only schedule half-open-timeout delete job after successfully handling IKE_SA_INIT 
We want to avoid this allocation if the initial message is invalid (e.g.
if the message ID is != 0).
 2013-07-29 11:25:43 +02:00
Tobias Brunner 77ccff82cf ikev1: Always send ID payloads (traffic selectors) during Quick Mode 
Especially Windows 7 has problems if the peer does not send ID payloads
for host-to-host connections (tunnel and transport mode).

Fixes #319.
 2013-07-25 17:08:17 +02:00
Tobias Brunner 1f2d9c7688 watcher: Made notify array initialization compatible with older GCC versions 2013-07-25 16:57:42 +02:00
Tobias Brunner ebb4ad1baa unit-tests: Add additional tests for host_t 2013-07-25 11:28:26 +02:00
Tobias Brunner 7a192c57a3 imv-attestation: Properly measure complete directories 2013-07-25 11:28:26 +02:00
Tobias Brunner 116363e5c6 array: Number of items in get_size() is unsigned 
Otherwise, array->esize is promoted to int and if array->esize * num
results in a value > 0x7fffffff the return value would be incorrect due
the implicit sign extension when getting cast to size_t.
 2013-07-25 11:28:01 +02:00
Tobias Brunner d7dc4fedd1 stream: Ensure UNIX socket path is null terminated 2013-07-24 16:17:23 +02:00
Tobias Brunner e7d717cf01 kernel-pfkey: Add sanity check when deleting policies 2013-07-24 16:17:22 +02:00
Tobias Brunner e5455e9413 imv-os: check_packages() fails if product query fails 2013-07-24 16:17:22 +02:00
Tobias Brunner cfca183d55 pkcs5: Add missing break statements when checking crypto primitives 2013-07-24 16:17:22 +02:00
Tobias Brunner 346a4a1fc2 imv-scanner: Properly check snprintf() return value 2013-07-24 16:17:22 +02:00
Tobias Brunner 16748bdff7 socket-dynamic: Properly initialize IPv6 address 2013-07-24 16:17:22 +02:00
Tobias Brunner 5baec6448d unit-tests: Add test for host_create_netmask() 2013-07-24 16:17:21 +02:00
Tobias Brunner 6e2ec33f9d host: Prevent overflow in host_create_netmask() if mask is 0 or 32/128 2013-07-24 16:17:03 +02:00
Tobias Brunner a00ac1d9ee imv-attestation: Use proper cast for length when using %.*s 2013-07-24 10:54:47 +02:00
Tobias Brunner 0c76d820dc tnc-ifmap: Use proper cast for length when using %.*s 2013-07-24 10:54:47 +02:00
Tobias Brunner cfdd23b967 capabilities: Proper error handling when reading groups 2013-07-24 10:54:26 +02:00
Tobias Brunner 3021139f6f strongswan.conf: Moved some stuff around 2013-07-23 12:23:05 +02:00
Tobias Brunner 5b1e3d3fdc ipsec: Add --piddir to retrieve the PID/socket directory 2013-07-22 18:12:04 +02:00
Tobias Brunner 517823b466 starter: Properly refer to the ipsec script if it was renamed 2013-07-22 18:00:19 +02:00
Tobias Brunner 62293ed271 coupling: Fix call to call_hook() 2013-07-22 17:53:56 +02:00
Tobias Brunner 2ed8b36a8a strongswan.conf: Add missing options 2013-07-22 17:46:41 +02:00
Tobias Brunner 146fa8b2d3 charon-xpc: Use correct namespace when setting default settings 2013-07-22 17:44:37 +02:00
Tobias Brunner a14d907e33 tnc-pdp: Fix reading port setting from strongswan.conf 2013-07-22 17:43:54 +02:00
Tobias Brunner 82b1a38601 tkm: Properly refer to includes now that AM_CPPFLAGS is used 2013-07-19 09:02:04 +02:00
Tobias Brunner 8f1b44b40c keychain: Use AM_CPPFLAGS instead of INCLUDES 2013-07-19 09:01:39 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Tobias Brunner e5b5a66712 kernel-pfkey: Fail route installation if remote TS matches peer 2013-07-18 15:41:36 +02:00
Tobias Brunner 29bdfb4086 kernel-libipsec: Fail route installation if remote TS matches peer 2013-07-18 15:41:13 +02:00
Tobias Brunner dfc9902013 capabilities: Some plugins don't actually require capabilities at runtime 2013-07-18 15:25:35 +02:00
Tobias Brunner 027676f750 capabilities: Add function to check if a capability is held, without keeping it 
This can be useful if capabilities are not required anymore after
dropping privileges.
 2013-07-18 15:25:35 +02:00
Tobias Brunner 07a9d5c91a ike: Fix reestablishing SAs if no child-creating tasks are queued 2013-07-18 10:40:08 +02:00
Tobias Brunner 79b6ead1e4 unity: Replicate default behavior if no UNITY_SPLIT_INCLUDE attributes were received 2013-07-17 18:23:57 +02:00
Tobias Brunner 56b0fac8c9 unity: Allow UNITY_LOCAL_LAN to be longer than 8 bytes 2013-07-17 18:23:57 +02:00
Tobias Brunner c7d0b80abb unity: Fix memory leak in provider 2013-07-17 18:23:57 +02:00
Tobias Brunner b2dfa0624d ipsec.conf.5: closeaction is now supported for IKEv1 2013-07-17 18:18:57 +02:00
Tobias Brunner a9ffb48f21 ikev1: Reestablish IKE_SA/CHILD_SAs if it gets deleted by the peer 
We call ike_sa_t.reestablish() so the IKE_SA is only recreated if any
CHILD_SA requires it.
 2013-07-17 18:16:59 +02:00
Tobias Brunner 68db844f99 ike: Migrate queued CHILD_SA-creating tasks when reestablishing an IKE_SA 2013-07-17 18:16:58 +02:00
Tobias Brunner 6b99e4b7e0 Merge branch 'kernel-pfroute-mobility' 
This improves the behavior of the kernel-pfroute plugin (and sometimes
the kernel-pfkey plugin) in case of mobility, mostly when used as as
client but also as gateway, if clients are mobile.
 2013-07-17 17:49:26 +02:00
Tobias Brunner fae4d67adc kernel-pfroute: Ignore IP address changes if address is %any 2013-07-17 17:45:18 +02:00